Department for Education (DfE) Information Management Assessment Programme

Action Plan

The following table sets out the recommendations from the TNA Information Management Assessment undertaken in July 2009 and shows the Actions, Priority and Timescale in which DfE have already or plan to take the necessary actions as at July 2011.

| # | Recommendation | Actions | Priority High/Low/Medium | Timescale | Owner | Observations | Delivered? | |----|--------------------------------------------------------------------------------|-------------------------------------------------------------------------|--------------------------|-----------|--------------------------------------------|------------------------------------------------------------------------------|------------| | R1 | In line with the Hannigan Review guidance, DfE should ensure that they have board representation covering all aspects of information risk, and not just information security. | Recognise need to manage all aspects of information risk and ensure representation at Board Level. | High | 2009-2011 | Senior Information Risk Owner (SIRO) | SIRO is Director General Corporate Services and is a Board Member. Assumed responsibility 2010. | Yes | | R2 | The Board should follow the guidance set out in the Information Matters report and consider information risk alongside, and as a contributory part of, other key risks, and give it priority accordingly. | Bring Information Management Matters and Information Management Assessment and proposed response of the Information Workplace programme (IWP) before relevant Departmental Committees for scrutiny and adoption | High | 2009-2011 | Chief Information Officers Group (CIOG) | Audit and Risk Assurance scrutinised risks and considered Information Management Assessment report in February 2010; Board scrutinised and recommended acceptance by the Accounting Officer of the IWP programme as a proportionate and sensible way forward to manage information risk | Yes. IWP delivered 2010 |

Report into corporate risk registers and monitor information risk

| Priority High/Low/Medium | Timescale | Owner | Observations | Delivered? | |--------------------------|-----------|--------------------------------------------|------------------------------------------------------------------------------|------------| | High | 2009-2011 | SIRO, CIOG | Risks monitored through updates to Departmental Risk Registers, IWP programme; Corporate | Yes | | R3 | DfE should consider the formation of an Information Management Board to oversee all aspects of knowledge and information management. | Review current governance arrangements and consider whether there should be a single overall board for KIM | Medium | 2009-2011 | CIOG | Reviewed but concluded that the most appropriate ‘home’ is overarching corporate transformation boards. Currently, Business Systems Programmes Board. | Yes | | R4 | DfE, in line with the KIM reporting structure, should develop and communicate clear responsibilities for all staff. | Review KIM function and how relates to the wider responsibilities of staff across the department | Review policies and revise to enhance departmental capability | Medium | 2009-2010 | CIOG | Clear communication of policies and staff responsibilities through IWP programme. Policies regularly reviewed and embedded at point of use in Workplaces and intranet | Yes | | | | Communicate new processes and responsibilities through the Information Workplace Programme (Content Managers/Site Administrators; Site Owner; Account Managers (KRM Team)) | | Medium | Apr 2010 and ongoing | CKO | Policies embedded at point of use; content managers supported through forum and regular newsletter; playground; engagement from Knowledge and Records Management Team (KRMT) | Yes and ongoing | | | | Review capacity and identify KIM professional roles | | Medium | 2009-2010 | CKO | Clear roles and responsibilities defined and re-organisation of KIM | Yes | | R5 | DfE to ensure that the IWP champion roles are clearly defined and fully supported. | Identify roles required and support needed for sustainability of the solution. | Medium | Apr 2010 and ongoing | CKO | Roles identified through change management stream of IWP programme. Engagement is ongoing but will take opportunity of upgrade in 2012 for re-focus and refresh of roles. Support provided through guidance, training, KRMT. | Yes and ongoing | | R6 | DfE to define, communicate and mitigate Information Management risk within its corporate and business reporting systems. | Review content of corporate communications channels for information management risk | Medium | 2010 - 2011 | CIOG | See R2. Information management risk embedded in communications for expected corporate behaviours for Workplaces | Yes and ongoing | | R7 | DfE should define what information it needs to keep, with the support of The National Archives, and ensure that all staff are aware of this. | Review policies and identify what information DfE needs to keep | Medium | 2009 - 2010 | CKO | Policies embedded in Workplaces at point of use including content type to ensure retention. Worked with policy makers to identify what needs to be kept. Further work ongoing with The National Archives. | Yes and ongoing |

Communicate policies to all staff | Medium | 2009 - 2010 | CKO | Policies communicated at | Yes | | R8 | DfE should revise the records and information management policies to ensure that they include fully the use of digital media. | Review policies to ensure that electronic records are included as well as paper. | Medium | 2010 | CKO | Revised records management policy including electronic records published in all Workplaces and intranet | Yes and ongoing | | R9 | DfE should review the current resource levels to ensure that it will continue to meet future statutory requirements. | Review operating model for KIM | Medium | 2010 | CKO | Review led to merging of library and information and records management teams to become the Knowledge and Records Management team. | Yes | | | Review ongoing demand for KIM services | Medium | 2010 | CKO | Service capacity doubled as result of extending roles of existing team and defining new Account Manager role. | Yes | | R10 | DfE should develop a migration policy to manage legacy information. | Migrate legacy records from Meridio into Legacy Records Centre | Medium | 2009 - 2010 | CKO | Information reviewed and migrated from Meridio into Legacy Records Centre | Yes | | | Review and migrate content from shared areas into IWP Records Centre | Long term | 2010 - | CKO | In progress. Users encouraged to migrate content, but no overall project instigated. The shared area lockdown tool has now been developed and will be implemented alongside the implementation of the new Desktop | No. | | R11 | DfE should review its email policy given the potential long term risks to the organisation. | Improve records declaration and email management in Workplaces | Medium | 2010 | CKO | Third party tool implemented for this purpose | Yes, September 2010 | |-----|---------------------------------------------------------------------------------|-------------------------------------------------|--------|------|-----|-----------------------------------------------|-------------------| | | Review and update existing guidance | Medium | Medium | | CKO | Done, Also the move to Exchange 2010 will provide the opportunity to update the guidance and embed new practice, scheduled for Q3/4 2011/12. | Yes and ongoing | | R12 | DfE should review its guidance on use of off-site storage to ensure that only information that needs to be retained is retained. | Implement Service Level Appraisal Questionnaires | Medium | Medium | DRO | Reduced need for physical review; aided bulk destruction process and reduced storage | Yes | | | Constantly review storage requirements | Medium | Medium | | DRO | Core function of RMT; greater VFM achieved in contract with external supplier FY 2010 onwards | Yes | | | Review guidance on intranet | Medium | 2010 | | DRO | Reviewed and published on the intranet. | Yes | | R13 | FOI and DP training should be included in all corporate induction programmes, in the overall context of the importance of managing DFE’s information effectively and securely. | Review FOI and DP training provision | Medium | Medium | Information Rights Team (IRT) | Considered but as recruitment much reduced induction training not seen as appropriate or effective. Will continue with intranet guidance (revised early 2011); awareness sessions and training on demand; in-depth briefings on ad hoc basis. IRT delivered 25 sessions on FOI 2010. Joint sessions (FOI and DP) are planned to support new Executive | No - consider delivery of online guidance and targeted advice across Department as best way forward. | | R14 | The department should review the material it makes available for re-use to determine if there are further information assets that could be surfaced and released proactively, in line with the Government’s ‘Making Public Data Public’ initiative (2009). From 2010 Public Data Transparency Principles. | Aiming to provide all our data (statistics) in one place on our website and integrate this into data.gov.uk. Data will be available in xml and csv formats. | Medium | Medium | Digital Communication s Unit | Launch aimed for July 2011 on DfE web site | Yes | | R15 | DfE should assess the utility of key performance measures for information management, in line with the assessment of information risk, and with the goals of DfE, to ensure that it is clear on the goals of the team in relation to the business. | KPIs for IWP and benefits tracking | Medium | 2010 - 2011 | CKO | Monthly reporting. Providing evidence of improved information management | Yes Sept 2010 and ongoing | | | | Baseline IWP benefits before upgrade to SP2010 | Medium | 2011 - 2012 | CKO | Will enable accounting for benefits realisation | No – date of upgrade in 2012 not yet known. | | | | Review and develop simple indicators for paper records management | Medium | Medium | CKI | Pending and to be carried forward | No | | R16 | DfE should develop an integrated IWP Champion and Information Manager support programme to run concurrently with the implementation project. | Investigate viability of integrating Intranet Champions and Workplace Content Managers in next phase of IWP | Medium | 2010 | CKO | Upgrade to SP2010 an opportunity to re-engage with Workplace owners and champions. Support mechanisms include fortnightly newsletter to Content Managers and Content Managers Forum | No | | R17 | DfE should introduce training on information and record keeping as part of all its induction programmes that emphasises how critical | Review provision of training in induction programmes | Medium | Medium | CKO | Recruitment very much reduced now. Basics covered in HR led induction programmes for former GO and ALB | Yes - under further review | | R18 | DfE should ensure that IRMT, HR and others develop an appropriate training programme that includes knowledge and information management for all staff. | |-----|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | | Review IWP training programmes to include knowledge and information management | | | Incorporate broader context into customer engagement activities of KRM Team | | | See also R17 |

| R19 | DfE to review training methods and assess ongoing support to ensure that maximum benefit is derived from the training for individual staff and the department. | |-----|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | | Review take up of IWP training programme | | | Review training channels including online guidance/classroom/activities of KRM Team in account manager role for IWP |

| Good information management is as a business activity that every team 'owns'. | |-----------------------------------------------------------------------------| | Review and promote other training channels including support provided by KRMT in driving up usage of Workplaces | | Basics communicated in IWP training |

| Department | IMA Team | Information Management Consultant | |------------|----------|-----------------------------------| | | | | | R20 | DfE to work with The National Archives Web Continuity Team to ensure web content is captured. | Identify existing guidance and standards and ensure that new websites are set up appropriately | Medium | Medium | Digital Communication s Unit | Web content has been and continues to be captured for ALBs closure as part of ALB Reform Programme | Yes | |-----|-------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------|-------|-------|-----------------------------|-------------------------------------------------------------------------------------------------|-----| | R21 | DfE should recognise that the Knowledge of the organisation must be managed, and that a formal and mandated set of processes, systems and principles be established and governed. | Establish Knowledge and Information Management maturity model communicated as the workplace Online Story on the intranet | Medium | Medium 2010 onwards | CKO | A KIM maturity model has been developed covers technology features against KM practice. It is deployed when considering what level of Workplaces an organisational unit requires. | Yes | | | | Deliver systems, processes based on IM principles and drive up their usage as this means improved information and knowledge management | Medium | Medium 2010 onwards | CKO | IWP policy identifies new ways of managing documents and records based on sound information management principles. Although organisational culture does not permit “mandation”. IWP usage continues to increase; 12,000 records declared by June 2011. | Yes | | R22 | DfE to consider implementing a formal repository of Knowledge and Information assets to maintain the corporate memory. | Implement wiki-like repository for sharing information and knowledge assets | Medium | Medium | CKO | The Knowledge implemented July 2010. Comprises briefings and user generated content in the form of insights and experience of policy makers. It is | Yes | | Department | IMA Team | Information Management Consultant | |------------|---------|-----------------------------------|

intended to be shared across the education sector.